In the Claims : 

Please amend Claims 1, 2, 5, 13, and 26 as indicated below. The status of all 
pending claims is as follows: 

1 . (Currently Amended) An unauthorized access prevention system which 
resides within a user's communication network , including: 

a traffic recording unit recording information on traffic that flows into a the 
user's communication networ k and arrives in a customer site ; 

a search unit searching, from the information recorded in the traffic recording 
unit, the flowing-in path of unauthorized access, which is transmitted from a transmitter and 
is included in the traffic, to services disclosed from athe customer site to other 
communication networks adjacent to the user's communication network via the user's 
communication network; 

a determination unit determining a countermeasure implementation planning 
place for protecting the services from the unauthorized access based on a result of the search; 
and 

a notification unit notifyin g only a flow source that is one of the other 
communication networks adjacent to th e us e r's communication network of the determination 
of the countermeasure implementation planning place, when the determination unit 
determines the flow source as the countermeasure implementation planning place for a reason 
that the unauthorized access was flowed into the user's communication network. 
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2. (Currently Amended) A recording medium in which a program that 
directs a computer residing within a user's communication network to implement a 
countermeasure against unauthorized access is recorded and in which the program can be 
read by the computer, and the program directs the computer to perform the following 
processes by being executed by the computer: 

a detection process of detecting an unauthorized access transmitted from a 
transmitter to services disclosed from a customer site to other communication networks 
adjacent to the user's communication network via the user's communication network; and 

when the detection of the unauthorized access is notified, performs the 
following pfeees sprocesses : 

a search process of searching the flowing-in path of the unauthorized access to 
the services disclosed from the customer site user's communication network ; 

a determination process of determining a countermeasure implementation 
planning place for protecting the services from the unauthorized access based on a result of 
the search; and 

a notification process of notifyin g only a flow source that is one of the other 
communication networks adjac e nt to the user's communication network of the determination 
of the countermeasure implementation planning place, when the determination unit 
determines the flow source as the countermeasure implementation planning place for a reason 
that the unauthorized access was flowed into the user's communication network. 
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3-4. (Cancelled) 



5. (Currently Amended) The recording medium according to claim 2, 
wherein the process of searching the flowing-in path is performed by the computer based on 
the monitoring information on the traffic transmitted by athe user's communication network 
and the unauthorized access information indicating the contents of the unauthorized access. 

6. (Original) The recording medium according to claim 5, wherein the 
monitoring information includes at least the position information on an edge router arranged 
on the border between the user's communication network and the communication network 
adjacent to the user's communication network and the monitoring information on the traffic 
that flows into the user's communication network via the edge router. 

7. (Previously Presented) The recording medium according to claim 2, 
wherein the notification process makes the computer execute a process of notifying the 
determination to the flow source after mutual attestation is conducted with the flow source of 
the unauthorized access. 

8. (Original) The recording medium according to claim 2, wherein the 
process of notifying the determination to the flow source after information on a security 
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policy for the operation of each network is exchanged with the flow source that transmits the 
unauthorized access is performed by the computer. 

9. (Previously Presented) The recording medium according to claim 8, 
wherein information on a security policy is the information indicating the time required until 
the counter-measure against the unauthorized access is cancelled after the unauthorized access 
is not detected any more. 

10. (Previously Presented) The recording medium according to claim 9, 
wherein when the time indicated by the information on the security policy differs between the 
user's communication network and the flow source, a shorter time of the two is used as the 
time required until the countermeasure against unauthorized access is cancelled after the 
unauthorized access is not detected any more. 

1 1 . (Previously Presented) The recording medium according to claim 10, 
wherein the process of notifying the flow source of the determination and the information 
indicating the time required until the countermeasure against the unauthorized access is 
cancelled after the unauthorized access is not detected any more is performed by the 
computer. 
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12. (Original) The recording medium according to claim 2, wherein the 
process of notifying the flow source of the unauthorized access of the determination using the 
communication path that differs from the flowing-in path of the unauthorized access is 
performed by the computer. 

13. (Currently Amended) A recording medium in which a program that 
directs a compute r residing within a user's communication network to implement a 
countermeasure against unauthorized access is recorded and in which the program can be 
read by the computer, and the program directs the computer to perform the following 
processes by being executed by the computer: 

a detection process of detecting an unauthorized access transmitted from a 
transmitter to services disclosed from a customer site to other communication networks 
adjacent to the user's communication network via the user's communication network; and 

when the detection of the unauthorized access is notified, performs the 
following preeess processes : 

a search process of searching the flowing-in path of the unauthorized access to 
the services disclosed from the customer sit e user's communication n e twork : 

a determination process of determining a countermeasure implementation 
planning place for protecting the services from the unauthorized access based on a result of 
the search; and 
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a notification process forjudging whether a flow source , which is one of the 
other communication networks, adjacent to the us e r's communication n e twork is notified of 
the determination, when it is determined that the flow source is the countermeasure 
implementation planning place for a reason that the unauthorized access was flowed into the 
user's communication network, wherein 

the notification process notifies only the flow source of the determination of the 
countermeasure implementation planning place, when it is judged that the flow source is 
notified of the determination, and 

by having the program executed by the computer, 

an unauthorized access countermeasure implementation control process that has 
the countermeasure for protecting the services from the unauthorized access implemented in 
the flow source when it is judged that the determination will not be notified to the flow 
source based on the above notification process is further performed by the computer. 

14. (Previously Presented) The recording medium according to claim 13, 
wherein the judgement is made based on judgement information on the flow source that is 
given in advance. 

15. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process that 
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has the countermeasure for protecting the services from the unauthorized access implemented 
in the user's communication network based on the determination that said countermeasure is 
implemented in the user's communication network is performed by the computer. 

16. (Original) The recording medium according to claim 15, wherein the 
process of implementing the countermeasure in the POP (point of presence) edge router to 
which the flow source of the unauthorized access is connected is performed by the computer. 

17. (Previously Presented) The recording medium according to claim 16, 
wherein the process of identifying the POP edge router to which the transmitter is connected 
based on the information obtained from the operation management system that manages the 
operation of the user's communication network is further performed by the computer. 

18. (Original) The recording medium according to claim 1 5, wherein 
by having the program executed by the computer; 

the process of obtaining a notification of the determination that unauthorized 
access to the services disclosed from a communication network different from the user's 
communication network is made to flow into said other communication network is further 
performed by the computer; and 

the process of implementing the countermeasure for protecting the services 
disclosed from said other communication network from the unauthorized access related to the 
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notification in the user's communication network when the notification is obtained by the 
notification obtaining process is performed by the computer. 

19. (Original) The recording medium according to claim 15, wherein the 
countermeasure implemented by the unauthorized access countermeasure implementation 
control process is cancelled after the unauthorized access is not detected any more and a 
preset time passes. 

20. (Previously Presented) The recording medium according to claim 19, 
wherein the preset time is set based on the security policy on the network operation of both 
the user's communication network and the other communication network. 

2 1 . (Original) The recording medium according to claim 20, wherein when 
the times set between the user's communication network and the other communication 
network based on the security policy on the network operation of both networks differ 
between both networks, the countermeasure is cancelled after the unauthorized access is not 
detected any more and a shorter time of the two passes. 

22. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the process of obtaining a notification of the determination that unauthorized 
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access to the services disclosed from a communication network different from the user's 
communication network is made to flow into said other communication network is performed 
by the computer; 

the process of searching the flowing-in path of the unauthorized access related 
to the notification in the user's communication network when the notification is obtained by 
the notification obtaining process is performed by the computer; 

the process of determining the place to implement the countermeasure for 
protecting the services disclosed from said other communication network from the 
unauthorized access related to the notification based on the result of the search when the 
notification is obtained by the notification obtaining process is performed by the computer; 
and 

the process of notifying, according to a determination that the countermeasure 
is implemented in the flow source that makes the unauthorized access related to the 
notification flow into the user's communication network when the notification is obtained by 
the notification obtaining process, the determination to the flow source is performed by the 
computer. 

23. (Original) The recording medium according to claim 22, wherein 
by having the program executed by the computer; 

the unauthorized access countermeasure implementation control process that 
has the countermeasure for protecting the services disclosed from the user's communication 
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network or the other communication network from the unauthorized access related to the 
notification implemented in the communication network of the notification source of the 
notification when the notification obtained by said notification obtaining process is the same 
as that obtained in the past is further performed by the computer. 

24. (Original) The recording medium according to claim 23, wherein the 
process of notifying the information that uniquely identifies the unauthorized access related 
to the notification when the determination is notified is performed by the computer. 

25. (Original) The recording medium according to claim 2, wherein 
by having the program executed by the computer; 

the process of recording the history of the notification is further performed by 

the computer. 

26. (Currently Amended) An unauthorized access prevention method 
performed by an unauthorized access prevention system which resides within a user's 
communication network , including: 

searching the flowing-in path of unauthorized access transmitted from a 
transmitter to the-services disclosed from a customer site to other communication networks 
adjacent to the user's communication network via the user's communication network; 

determining a countermeasure implementation planning place for protecting the 

11 



services from the unauthorized access based on a result of the search; and 

notifyin g only a flow source that is one of the other communication networks 
adjacent to th e user's communication network of the determination of the countermeasure 
implementation planning place, when the determination unit determines the flow source as 
the countermeasure implementation planning place for a reason that the unauthorized access 
was flowed into the user's communication network. 



27. (Cancelled) 
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